The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA) and international partners warned that Chinese government-linked threat actors are combining automated scanning, large-scale botnets and hands-on hacking techniques to infiltrate networks and steal sensitive data from organizations worldwide. The joint advisory said Integrity Technology Group, a China-based, for-profit company with links to the Chinese government, enables these hackers to exploit networks of U.S. and foreign organizations across multiple sectors.
The advisory detailed how the hackers combine compromised infrastructure and legitimate software with specialized tools to maintain access and exfiltrate email data and credentials. Their techniques include automated reconnaissance and vulnerability scanning, exploiting internet-facing systems, and using virtual private network software to establish persistence within compromised environments.
In a recent 58-page advisory, the agencies identified Integrity Technology Group as targeting organizations across multiple sectors, including U.S. critical infrastructure. The actors use tactics associated with activity publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett, exploiting vulnerabilities, conducting cross-site scripting attacks and using password spraying to gain access to networks.
The agencies urged organizations to review the advisory’s indicators of compromise and documented TTPs (tactics, techniques and procedures), hunt for evidence of unauthorized access, and strengthen defenses around internet-facing services, account credentials and remote access. The guidance is intended to help organizations identify malicious activity, mitigate exposure and protect sensitive information from China-linked cyber operations.
“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing,” Chris Butera, acting executive assistant director for cybersecurity, said in a media statement. “CISA urges organizations to review this advisory to be aware of the wide range of tactics used by these actors and implement recommended actions and mitigations. The advisory underscores the critical role of collaboration between government agencies and the private sector.”
“Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them,” said Brett Leatherman, assistant director of the FBI’s cyber division. “Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide. We urge every organization to apply this advisory’s mitigations and report suspicious activity to their local FBI field office.”
The advisory noted that the hackers begin by using freely available scanning tools to search networks and web applications for weaknesses, the advisory said, and the reliance on open source tools suggests they tend to look for more vulnerable targets. Since at least 2017, they have also used a malicious web application known as MicroScan, which contains more than 1,300 penetration testing scripts designed to scan websites for specific vulnerabilities across a range of widely used services.
To gain access, the actors have relied primarily since at least mid-January 2021 on command line utilities built on exploit code, the advisory said. They have also used cross-site scripting attacks to modify webpages so that visitors see a fake login prompt that harvests usernames and passwords. After a user enters credentials, the page offers a download that contains malware disguised as legitimate Windows software. The FBI attributes the domain the malware communicates with to Integrity Technology Group and assesses that the malware likely targets user email data for exfiltration.
The actors also target Microsoft Office 365 cloud accounts and Exchange email servers, using an open source tool to try to break into accounts through password spraying and password guessing across multiple access points. The advisory urged network defenders to account for those access points when protecting against the activity.
To maintain access, hackers install legitimate virtual private network software on victim devices, which helps hide their command-and-control communications and makes it harder for victims to trace malicious network activity back to them. The advisory said they download the software from infrastructure they control, configure it to reconnect automatically whenever a device starts, and often give the installers names that mimic common Windows executables. Because the software is legitimate, endpoint detection tools are also less likely to flag it. The actors use the connections to keep persistent remote access to victim devices and enable data exfiltration, and they have also used them to reach other targets, including cybersecurity websites.
The FBI observed the actors downloading databases or manually pulling data from victim emails, then staging the stolen data under discreet file names intended to avoid detection. The advisory identified several domains and subdomains that hosted the VPN connections on victim servers, and it lists the file names the actors used.
The advisory also found that the actors built a bot to harvest emails from victims, using a standalone script designed to work with Microsoft’s Exchange Web Services interface, which gives access to email, calendars and contacts. The script uploaded emails to a remote server, obscured the directories and files it created, and compressed the messages before exfiltration. In some instances, the actors also encrypted the emails with a password. The advisory ties the bot’s main command-and-control domain to the activity and describes the script’s operation in detail.
If a potential compromise is detected, the advisory said organizations should first determine which hosts were affected and isolate them by quarantining them or taking them offline. They should then launch threat hunting to scope the intrusion, collecting and reviewing artifacts, logs and other data to identify the actors’ tactics, compromised devices and accounts, and a timeline of activity.
To contain the incident and remove these hackers from the network, the agencies recommended applying eviction countermeasures once enough hunting data has been gathered to guide their selection. They pointed to CISA’s Eviction Strategies Tool, which combines a web application called Playbook-NG with a database of post-compromise countermeasures called COUN7ER, to build a systematic eviction plan. The resulting playbook lists recommended response actions based on the actors’ tactics, along with each action’s intended outcome, preparatory steps and associated risks. The final step is to harden the network to prevent further malicious activity.
The advisory recommends that network defenders and organizations adopt a set of mitigations that align with the Cross-Sector Cybersecurity Performance Goals developed by CISA and the National Institute of Standards and Technology, which set a minimum baseline of practices and protections for all organizations. They advised disabling unused services and ports, configuring applications to reveal as little information as possible on login pages and in banners, and considering attack surface management services to identify exposed services. They also urged sanitizing user input in web applications to prevent cross-site scripting payload injection, and implementing identity, credential and access management policies with multifactor authentication for all services where possible, particularly webmail, VPNs and accounts that access critical systems.
The agencies also called for stronger monitoring and network design. Organizations should watch for unauthorized use of living-off-the-land tools and unexpected Active Directory replication, segment their networks so a compromised device cannot reach sensitive resources in another organizational unit, and monitor cloud accounts for connected applications that can access sensitive file and email data.
They also recommended reviewing web application access logs for exploitation attempts such as directory traversal, command injection and enumeration, and watching for abnormal or high-volume traffic using firewalls and intrusion detection systems, noting that a distributed denial-of-service attempt may look like normal traffic. Defenders should also monitor for unusually high outbound uploads from devices that normally download more than they upload, investigate unusual IP addresses and ports in command lines, registry entries and firewall logs, check perimeter firewall configurations for unauthorized changes, and look for abnormal account activity such as logons outside working hours or from two distant locations at once.
On resilience and hygiene, the advisory recommended applying software and firmware patches, using automatic update channels from trusted network locations, and distrusting emails that claim to supply updates through attachments or links to untrusted sites. Organizations should run antivirus software with real-time detection on all hosts, replace end-of-life products with supported alternatives, and use the strongest feasible authentication, along with hardened authentication protocols and access lists, regular rotation of service account keys and role-based access control.
The agencies also advised keeping multiple copies of sensitive data and servers in a physically separate, secure location, regularly backing up data and password-protecting offline copies so they cannot be modified or deleted from the system where the data resides, training users on security principles and emerging threats such as ransomware and phishing, and regularly engaging reputable penetration testing services to evaluate the public attack surface and fix the vulnerabilities these actors most commonly exploit.
